1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* |
3 | * Copyright (c) 2016, Amir Vadai <amir@vadai.me> |
4 | * Copyright (c) 2016, Mellanox Technologies. All rights reserved. |
5 | */ |
6 | |
7 | #include <linux/module.h> |
8 | #include <linux/init.h> |
9 | #include <linux/kernel.h> |
10 | #include <linux/skbuff.h> |
11 | #include <linux/rtnetlink.h> |
12 | #include <net/geneve.h> |
13 | #include <net/vxlan.h> |
14 | #include <net/erspan.h> |
15 | #include <net/netlink.h> |
16 | #include <net/pkt_sched.h> |
17 | #include <net/dst.h> |
18 | #include <net/pkt_cls.h> |
19 | #include <net/tc_wrapper.h> |
20 | |
21 | #include <linux/tc_act/tc_tunnel_key.h> |
22 | #include <net/tc_act/tc_tunnel_key.h> |
23 | |
24 | static struct tc_action_ops act_tunnel_key_ops; |
25 | |
26 | TC_INDIRECT_SCOPE int tunnel_key_act(struct sk_buff *skb, |
27 | const struct tc_action *a, |
28 | struct tcf_result *res) |
29 | { |
30 | struct tcf_tunnel_key *t = to_tunnel_key(a); |
31 | struct tcf_tunnel_key_params *params; |
32 | int action; |
33 | |
34 | params = rcu_dereference_bh(t->params); |
35 | |
36 | tcf_lastuse_update(tm: &t->tcf_tm); |
37 | tcf_action_update_bstats(a: &t->common, skb); |
38 | action = READ_ONCE(t->tcf_action); |
39 | |
40 | switch (params->tcft_action) { |
41 | case TCA_TUNNEL_KEY_ACT_RELEASE: |
42 | skb_dst_drop(skb); |
43 | break; |
44 | case TCA_TUNNEL_KEY_ACT_SET: |
45 | skb_dst_drop(skb); |
46 | skb_dst_set(skb, dst: dst_clone(dst: ¶ms->tcft_enc_metadata->dst)); |
47 | break; |
48 | default: |
49 | WARN_ONCE(1, "Bad tunnel_key action %d.\n" , |
50 | params->tcft_action); |
51 | break; |
52 | } |
53 | |
54 | return action; |
55 | } |
56 | |
57 | static const struct nla_policy |
58 | enc_opts_policy[TCA_TUNNEL_KEY_ENC_OPTS_MAX + 1] = { |
59 | [TCA_TUNNEL_KEY_ENC_OPTS_UNSPEC] = { |
60 | .strict_start_type = TCA_TUNNEL_KEY_ENC_OPTS_VXLAN }, |
61 | [TCA_TUNNEL_KEY_ENC_OPTS_GENEVE] = { .type = NLA_NESTED }, |
62 | [TCA_TUNNEL_KEY_ENC_OPTS_VXLAN] = { .type = NLA_NESTED }, |
63 | [TCA_TUNNEL_KEY_ENC_OPTS_ERSPAN] = { .type = NLA_NESTED }, |
64 | }; |
65 | |
66 | static const struct nla_policy |
67 | geneve_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX + 1] = { |
68 | [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS] = { .type = NLA_U16 }, |
69 | [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE] = { .type = NLA_U8 }, |
70 | [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA] = { .type = NLA_BINARY, |
71 | .len = 128 }, |
72 | }; |
73 | |
74 | static const struct nla_policy |
75 | vxlan_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_VXLAN_MAX + 1] = { |
76 | [TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP] = { .type = NLA_U32 }, |
77 | }; |
78 | |
79 | static const struct nla_policy |
80 | erspan_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_MAX + 1] = { |
81 | [TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_VER] = { .type = NLA_U8 }, |
82 | [TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_INDEX] = { .type = NLA_U32 }, |
83 | [TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_DIR] = { .type = NLA_U8 }, |
84 | [TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_HWID] = { .type = NLA_U8 }, |
85 | }; |
86 | |
87 | static int |
88 | tunnel_key_copy_geneve_opt(const struct nlattr *nla, void *dst, int dst_len, |
89 | struct netlink_ext_ack *extack) |
90 | { |
91 | struct nlattr *tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX + 1]; |
92 | int err, data_len, opt_len; |
93 | u8 *data; |
94 | |
95 | err = nla_parse_nested_deprecated(tb, |
96 | TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX, |
97 | nla, policy: geneve_opt_policy, extack); |
98 | if (err < 0) |
99 | return err; |
100 | |
101 | if (!tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS] || |
102 | !tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE] || |
103 | !tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA]) { |
104 | NL_SET_ERR_MSG(extack, "Missing tunnel key geneve option class, type or data" ); |
105 | return -EINVAL; |
106 | } |
107 | |
108 | data = nla_data(nla: tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA]); |
109 | data_len = nla_len(nla: tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA]); |
110 | if (data_len < 4) { |
111 | NL_SET_ERR_MSG(extack, "Tunnel key geneve option data is less than 4 bytes long" ); |
112 | return -ERANGE; |
113 | } |
114 | if (data_len % 4) { |
115 | NL_SET_ERR_MSG(extack, "Tunnel key geneve option data is not a multiple of 4 bytes long" ); |
116 | return -ERANGE; |
117 | } |
118 | |
119 | opt_len = sizeof(struct geneve_opt) + data_len; |
120 | if (dst) { |
121 | struct geneve_opt *opt = dst; |
122 | |
123 | WARN_ON(dst_len < opt_len); |
124 | |
125 | opt->opt_class = |
126 | nla_get_be16(nla: tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS]); |
127 | opt->type = nla_get_u8(nla: tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE]); |
128 | opt->length = data_len / 4; /* length is in units of 4 bytes */ |
129 | opt->r1 = 0; |
130 | opt->r2 = 0; |
131 | opt->r3 = 0; |
132 | |
133 | memcpy(opt + 1, data, data_len); |
134 | } |
135 | |
136 | return opt_len; |
137 | } |
138 | |
139 | static int |
140 | tunnel_key_copy_vxlan_opt(const struct nlattr *nla, void *dst, int dst_len, |
141 | struct netlink_ext_ack *extack) |
142 | { |
143 | struct nlattr *tb[TCA_TUNNEL_KEY_ENC_OPT_VXLAN_MAX + 1]; |
144 | int err; |
145 | |
146 | err = nla_parse_nested(tb, TCA_TUNNEL_KEY_ENC_OPT_VXLAN_MAX, nla, |
147 | policy: vxlan_opt_policy, extack); |
148 | if (err < 0) |
149 | return err; |
150 | |
151 | if (!tb[TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP]) { |
152 | NL_SET_ERR_MSG(extack, "Missing tunnel key vxlan option gbp" ); |
153 | return -EINVAL; |
154 | } |
155 | |
156 | if (dst) { |
157 | struct vxlan_metadata *md = dst; |
158 | |
159 | md->gbp = nla_get_u32(nla: tb[TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP]); |
160 | md->gbp &= VXLAN_GBP_MASK; |
161 | } |
162 | |
163 | return sizeof(struct vxlan_metadata); |
164 | } |
165 | |
166 | static int |
167 | tunnel_key_copy_erspan_opt(const struct nlattr *nla, void *dst, int dst_len, |
168 | struct netlink_ext_ack *extack) |
169 | { |
170 | struct nlattr *tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_MAX + 1]; |
171 | int err; |
172 | u8 ver; |
173 | |
174 | err = nla_parse_nested(tb, TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_MAX, nla, |
175 | policy: erspan_opt_policy, extack); |
176 | if (err < 0) |
177 | return err; |
178 | |
179 | if (!tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_VER]) { |
180 | NL_SET_ERR_MSG(extack, "Missing tunnel key erspan option ver" ); |
181 | return -EINVAL; |
182 | } |
183 | |
184 | ver = nla_get_u8(nla: tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_VER]); |
185 | if (ver == 1) { |
186 | if (!tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_INDEX]) { |
187 | NL_SET_ERR_MSG(extack, "Missing tunnel key erspan option index" ); |
188 | return -EINVAL; |
189 | } |
190 | } else if (ver == 2) { |
191 | if (!tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_DIR] || |
192 | !tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_HWID]) { |
193 | NL_SET_ERR_MSG(extack, "Missing tunnel key erspan option dir or hwid" ); |
194 | return -EINVAL; |
195 | } |
196 | } else { |
197 | NL_SET_ERR_MSG(extack, "Tunnel key erspan option ver is incorrect" ); |
198 | return -EINVAL; |
199 | } |
200 | |
201 | if (dst) { |
202 | struct erspan_metadata *md = dst; |
203 | |
204 | md->version = ver; |
205 | if (ver == 1) { |
206 | nla = tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_INDEX]; |
207 | md->u.index = nla_get_be32(nla); |
208 | } else { |
209 | nla = tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_DIR]; |
210 | md->u.md2.dir = nla_get_u8(nla); |
211 | nla = tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_HWID]; |
212 | set_hwid(md2: &md->u.md2, hwid: nla_get_u8(nla)); |
213 | } |
214 | } |
215 | |
216 | return sizeof(struct erspan_metadata); |
217 | } |
218 | |
219 | static int tunnel_key_copy_opts(const struct nlattr *nla, u8 *dst, |
220 | int dst_len, struct netlink_ext_ack *extack) |
221 | { |
222 | int err, rem, opt_len, len = nla_len(nla), opts_len = 0, type = 0; |
223 | const struct nlattr *attr, *head = nla_data(nla); |
224 | |
225 | err = nla_validate_deprecated(head, len, TCA_TUNNEL_KEY_ENC_OPTS_MAX, |
226 | policy: enc_opts_policy, extack); |
227 | if (err) |
228 | return err; |
229 | |
230 | nla_for_each_attr(attr, head, len, rem) { |
231 | switch (nla_type(nla: attr)) { |
232 | case TCA_TUNNEL_KEY_ENC_OPTS_GENEVE: |
233 | if (type && type != TUNNEL_GENEVE_OPT) { |
234 | NL_SET_ERR_MSG(extack, "Duplicate type for geneve options" ); |
235 | return -EINVAL; |
236 | } |
237 | opt_len = tunnel_key_copy_geneve_opt(nla: attr, dst, |
238 | dst_len, extack); |
239 | if (opt_len < 0) |
240 | return opt_len; |
241 | opts_len += opt_len; |
242 | if (opts_len > IP_TUNNEL_OPTS_MAX) { |
243 | NL_SET_ERR_MSG(extack, "Tunnel options exceeds max size" ); |
244 | return -EINVAL; |
245 | } |
246 | if (dst) { |
247 | dst_len -= opt_len; |
248 | dst += opt_len; |
249 | } |
250 | type = TUNNEL_GENEVE_OPT; |
251 | break; |
252 | case TCA_TUNNEL_KEY_ENC_OPTS_VXLAN: |
253 | if (type) { |
254 | NL_SET_ERR_MSG(extack, "Duplicate type for vxlan options" ); |
255 | return -EINVAL; |
256 | } |
257 | opt_len = tunnel_key_copy_vxlan_opt(nla: attr, dst, |
258 | dst_len, extack); |
259 | if (opt_len < 0) |
260 | return opt_len; |
261 | opts_len += opt_len; |
262 | type = TUNNEL_VXLAN_OPT; |
263 | break; |
264 | case TCA_TUNNEL_KEY_ENC_OPTS_ERSPAN: |
265 | if (type) { |
266 | NL_SET_ERR_MSG(extack, "Duplicate type for erspan options" ); |
267 | return -EINVAL; |
268 | } |
269 | opt_len = tunnel_key_copy_erspan_opt(nla: attr, dst, |
270 | dst_len, extack); |
271 | if (opt_len < 0) |
272 | return opt_len; |
273 | opts_len += opt_len; |
274 | type = TUNNEL_ERSPAN_OPT; |
275 | break; |
276 | } |
277 | } |
278 | |
279 | if (!opts_len) { |
280 | NL_SET_ERR_MSG(extack, "Empty list of tunnel options" ); |
281 | return -EINVAL; |
282 | } |
283 | |
284 | if (rem > 0) { |
285 | NL_SET_ERR_MSG(extack, "Trailing data after parsing tunnel key options attributes" ); |
286 | return -EINVAL; |
287 | } |
288 | |
289 | return opts_len; |
290 | } |
291 | |
292 | static int tunnel_key_get_opts_len(struct nlattr *nla, |
293 | struct netlink_ext_ack *extack) |
294 | { |
295 | return tunnel_key_copy_opts(nla, NULL, dst_len: 0, extack); |
296 | } |
297 | |
298 | static int tunnel_key_opts_set(struct nlattr *nla, struct ip_tunnel_info *info, |
299 | int opts_len, struct netlink_ext_ack *extack) |
300 | { |
301 | info->options_len = opts_len; |
302 | switch (nla_type(nla: nla_data(nla))) { |
303 | case TCA_TUNNEL_KEY_ENC_OPTS_GENEVE: |
304 | #if IS_ENABLED(CONFIG_INET) |
305 | info->key.tun_flags |= TUNNEL_GENEVE_OPT; |
306 | return tunnel_key_copy_opts(nla, ip_tunnel_info_opts(info), |
307 | dst_len: opts_len, extack); |
308 | #else |
309 | return -EAFNOSUPPORT; |
310 | #endif |
311 | case TCA_TUNNEL_KEY_ENC_OPTS_VXLAN: |
312 | #if IS_ENABLED(CONFIG_INET) |
313 | info->key.tun_flags |= TUNNEL_VXLAN_OPT; |
314 | return tunnel_key_copy_opts(nla, ip_tunnel_info_opts(info), |
315 | dst_len: opts_len, extack); |
316 | #else |
317 | return -EAFNOSUPPORT; |
318 | #endif |
319 | case TCA_TUNNEL_KEY_ENC_OPTS_ERSPAN: |
320 | #if IS_ENABLED(CONFIG_INET) |
321 | info->key.tun_flags |= TUNNEL_ERSPAN_OPT; |
322 | return tunnel_key_copy_opts(nla, ip_tunnel_info_opts(info), |
323 | dst_len: opts_len, extack); |
324 | #else |
325 | return -EAFNOSUPPORT; |
326 | #endif |
327 | default: |
328 | NL_SET_ERR_MSG(extack, "Cannot set tunnel options for unknown tunnel type" ); |
329 | return -EINVAL; |
330 | } |
331 | } |
332 | |
333 | static const struct nla_policy tunnel_key_policy[TCA_TUNNEL_KEY_MAX + 1] = { |
334 | [TCA_TUNNEL_KEY_PARMS] = { .len = sizeof(struct tc_tunnel_key) }, |
335 | [TCA_TUNNEL_KEY_ENC_IPV4_SRC] = { .type = NLA_U32 }, |
336 | [TCA_TUNNEL_KEY_ENC_IPV4_DST] = { .type = NLA_U32 }, |
337 | [TCA_TUNNEL_KEY_ENC_IPV6_SRC] = { .len = sizeof(struct in6_addr) }, |
338 | [TCA_TUNNEL_KEY_ENC_IPV6_DST] = { .len = sizeof(struct in6_addr) }, |
339 | [TCA_TUNNEL_KEY_ENC_KEY_ID] = { .type = NLA_U32 }, |
340 | [TCA_TUNNEL_KEY_ENC_DST_PORT] = {.type = NLA_U16}, |
341 | [TCA_TUNNEL_KEY_NO_CSUM] = { .type = NLA_U8 }, |
342 | [TCA_TUNNEL_KEY_ENC_OPTS] = { .type = NLA_NESTED }, |
343 | [TCA_TUNNEL_KEY_ENC_TOS] = { .type = NLA_U8 }, |
344 | [TCA_TUNNEL_KEY_ENC_TTL] = { .type = NLA_U8 }, |
345 | }; |
346 | |
347 | static void tunnel_key_release_params(struct tcf_tunnel_key_params *p) |
348 | { |
349 | if (!p) |
350 | return; |
351 | if (p->tcft_action == TCA_TUNNEL_KEY_ACT_SET) |
352 | dst_release(dst: &p->tcft_enc_metadata->dst); |
353 | |
354 | kfree_rcu(p, rcu); |
355 | } |
356 | |
357 | static int tunnel_key_init(struct net *net, struct nlattr *nla, |
358 | struct nlattr *est, struct tc_action **a, |
359 | struct tcf_proto *tp, u32 act_flags, |
360 | struct netlink_ext_ack *extack) |
361 | { |
362 | struct tc_action_net *tn = net_generic(net, id: act_tunnel_key_ops.net_id); |
363 | bool bind = act_flags & TCA_ACT_FLAGS_BIND; |
364 | struct nlattr *tb[TCA_TUNNEL_KEY_MAX + 1]; |
365 | struct tcf_tunnel_key_params *params_new; |
366 | struct metadata_dst *metadata = NULL; |
367 | struct tcf_chain *goto_ch = NULL; |
368 | struct tc_tunnel_key *parm; |
369 | struct tcf_tunnel_key *t; |
370 | bool exists = false; |
371 | __be16 dst_port = 0; |
372 | __be64 key_id = 0; |
373 | int opts_len = 0; |
374 | __be16 flags = 0; |
375 | u8 tos, ttl; |
376 | int ret = 0; |
377 | u32 index; |
378 | int err; |
379 | |
380 | if (!nla) { |
381 | NL_SET_ERR_MSG(extack, "Tunnel requires attributes to be passed" ); |
382 | return -EINVAL; |
383 | } |
384 | |
385 | err = nla_parse_nested_deprecated(tb, TCA_TUNNEL_KEY_MAX, nla, |
386 | policy: tunnel_key_policy, extack); |
387 | if (err < 0) { |
388 | NL_SET_ERR_MSG(extack, "Failed to parse nested tunnel key attributes" ); |
389 | return err; |
390 | } |
391 | |
392 | if (!tb[TCA_TUNNEL_KEY_PARMS]) { |
393 | NL_SET_ERR_MSG(extack, "Missing tunnel key parameters" ); |
394 | return -EINVAL; |
395 | } |
396 | |
397 | parm = nla_data(nla: tb[TCA_TUNNEL_KEY_PARMS]); |
398 | index = parm->index; |
399 | err = tcf_idr_check_alloc(tn, index: &index, a, bind); |
400 | if (err < 0) |
401 | return err; |
402 | exists = err; |
403 | if (exists && bind) |
404 | return 0; |
405 | |
406 | switch (parm->t_action) { |
407 | case TCA_TUNNEL_KEY_ACT_RELEASE: |
408 | break; |
409 | case TCA_TUNNEL_KEY_ACT_SET: |
410 | if (tb[TCA_TUNNEL_KEY_ENC_KEY_ID]) { |
411 | __be32 key32; |
412 | |
413 | key32 = nla_get_be32(nla: tb[TCA_TUNNEL_KEY_ENC_KEY_ID]); |
414 | key_id = key32_to_tunnel_id(key: key32); |
415 | flags = TUNNEL_KEY; |
416 | } |
417 | |
418 | flags |= TUNNEL_CSUM; |
419 | if (tb[TCA_TUNNEL_KEY_NO_CSUM] && |
420 | nla_get_u8(nla: tb[TCA_TUNNEL_KEY_NO_CSUM])) |
421 | flags &= ~TUNNEL_CSUM; |
422 | |
423 | if (nla_get_flag(nla: tb[TCA_TUNNEL_KEY_NO_FRAG])) |
424 | flags |= TUNNEL_DONT_FRAGMENT; |
425 | |
426 | if (tb[TCA_TUNNEL_KEY_ENC_DST_PORT]) |
427 | dst_port = nla_get_be16(nla: tb[TCA_TUNNEL_KEY_ENC_DST_PORT]); |
428 | |
429 | if (tb[TCA_TUNNEL_KEY_ENC_OPTS]) { |
430 | opts_len = tunnel_key_get_opts_len(nla: tb[TCA_TUNNEL_KEY_ENC_OPTS], |
431 | extack); |
432 | if (opts_len < 0) { |
433 | ret = opts_len; |
434 | goto err_out; |
435 | } |
436 | } |
437 | |
438 | tos = 0; |
439 | if (tb[TCA_TUNNEL_KEY_ENC_TOS]) |
440 | tos = nla_get_u8(nla: tb[TCA_TUNNEL_KEY_ENC_TOS]); |
441 | ttl = 0; |
442 | if (tb[TCA_TUNNEL_KEY_ENC_TTL]) |
443 | ttl = nla_get_u8(nla: tb[TCA_TUNNEL_KEY_ENC_TTL]); |
444 | |
445 | if (tb[TCA_TUNNEL_KEY_ENC_IPV4_SRC] && |
446 | tb[TCA_TUNNEL_KEY_ENC_IPV4_DST]) { |
447 | __be32 saddr; |
448 | __be32 daddr; |
449 | |
450 | saddr = nla_get_in_addr(nla: tb[TCA_TUNNEL_KEY_ENC_IPV4_SRC]); |
451 | daddr = nla_get_in_addr(nla: tb[TCA_TUNNEL_KEY_ENC_IPV4_DST]); |
452 | |
453 | metadata = __ip_tun_set_dst(saddr, daddr, tos, ttl, |
454 | tp_dst: dst_port, flags, |
455 | tunnel_id: key_id, md_size: opts_len); |
456 | } else if (tb[TCA_TUNNEL_KEY_ENC_IPV6_SRC] && |
457 | tb[TCA_TUNNEL_KEY_ENC_IPV6_DST]) { |
458 | struct in6_addr saddr; |
459 | struct in6_addr daddr; |
460 | |
461 | saddr = nla_get_in6_addr(nla: tb[TCA_TUNNEL_KEY_ENC_IPV6_SRC]); |
462 | daddr = nla_get_in6_addr(nla: tb[TCA_TUNNEL_KEY_ENC_IPV6_DST]); |
463 | |
464 | metadata = __ipv6_tun_set_dst(saddr: &saddr, daddr: &daddr, tos, ttl, tp_dst: dst_port, |
465 | label: 0, flags, |
466 | tunnel_id: key_id, md_size: opts_len); |
467 | } else { |
468 | NL_SET_ERR_MSG(extack, "Missing either ipv4 or ipv6 src and dst" ); |
469 | ret = -EINVAL; |
470 | goto err_out; |
471 | } |
472 | |
473 | if (!metadata) { |
474 | NL_SET_ERR_MSG(extack, "Cannot allocate tunnel metadata dst" ); |
475 | ret = -ENOMEM; |
476 | goto err_out; |
477 | } |
478 | |
479 | #ifdef CONFIG_DST_CACHE |
480 | ret = dst_cache_init(dst_cache: &metadata->u.tun_info.dst_cache, GFP_KERNEL); |
481 | if (ret) |
482 | goto release_tun_meta; |
483 | #endif |
484 | |
485 | if (opts_len) { |
486 | ret = tunnel_key_opts_set(nla: tb[TCA_TUNNEL_KEY_ENC_OPTS], |
487 | info: &metadata->u.tun_info, |
488 | opts_len, extack); |
489 | if (ret < 0) |
490 | goto release_tun_meta; |
491 | } |
492 | |
493 | metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX; |
494 | break; |
495 | default: |
496 | NL_SET_ERR_MSG(extack, "Unknown tunnel key action" ); |
497 | ret = -EINVAL; |
498 | goto err_out; |
499 | } |
500 | |
501 | if (!exists) { |
502 | ret = tcf_idr_create_from_flags(tn, index, est, a, |
503 | ops: &act_tunnel_key_ops, bind, |
504 | flags: act_flags); |
505 | if (ret) { |
506 | NL_SET_ERR_MSG(extack, "Cannot create TC IDR" ); |
507 | goto release_tun_meta; |
508 | } |
509 | |
510 | ret = ACT_P_CREATED; |
511 | } else if (!(act_flags & TCA_ACT_FLAGS_REPLACE)) { |
512 | NL_SET_ERR_MSG(extack, "TC IDR already exists" ); |
513 | ret = -EEXIST; |
514 | goto release_tun_meta; |
515 | } |
516 | |
517 | err = tcf_action_check_ctrlact(action: parm->action, tp, handle: &goto_ch, newchain: extack); |
518 | if (err < 0) { |
519 | ret = err; |
520 | exists = true; |
521 | goto release_tun_meta; |
522 | } |
523 | t = to_tunnel_key(*a); |
524 | |
525 | params_new = kzalloc(size: sizeof(*params_new), GFP_KERNEL); |
526 | if (unlikely(!params_new)) { |
527 | NL_SET_ERR_MSG(extack, "Cannot allocate tunnel key parameters" ); |
528 | ret = -ENOMEM; |
529 | exists = true; |
530 | goto put_chain; |
531 | } |
532 | params_new->tcft_action = parm->t_action; |
533 | params_new->tcft_enc_metadata = metadata; |
534 | |
535 | spin_lock_bh(lock: &t->tcf_lock); |
536 | goto_ch = tcf_action_set_ctrlact(a: *a, action: parm->action, newchain: goto_ch); |
537 | params_new = rcu_replace_pointer(t->params, params_new, |
538 | lockdep_is_held(&t->tcf_lock)); |
539 | spin_unlock_bh(lock: &t->tcf_lock); |
540 | tunnel_key_release_params(p: params_new); |
541 | if (goto_ch) |
542 | tcf_chain_put_by_act(chain: goto_ch); |
543 | |
544 | return ret; |
545 | |
546 | put_chain: |
547 | if (goto_ch) |
548 | tcf_chain_put_by_act(chain: goto_ch); |
549 | |
550 | release_tun_meta: |
551 | if (metadata) |
552 | dst_release(dst: &metadata->dst); |
553 | |
554 | err_out: |
555 | if (exists) |
556 | tcf_idr_release(a: *a, bind); |
557 | else |
558 | tcf_idr_cleanup(tn, index); |
559 | return ret; |
560 | } |
561 | |
562 | static void tunnel_key_release(struct tc_action *a) |
563 | { |
564 | struct tcf_tunnel_key *t = to_tunnel_key(a); |
565 | struct tcf_tunnel_key_params *params; |
566 | |
567 | params = rcu_dereference_protected(t->params, 1); |
568 | tunnel_key_release_params(p: params); |
569 | } |
570 | |
571 | static int tunnel_key_geneve_opts_dump(struct sk_buff *skb, |
572 | const struct ip_tunnel_info *info) |
573 | { |
574 | int len = info->options_len; |
575 | u8 *src = (u8 *)(info + 1); |
576 | struct nlattr *start; |
577 | |
578 | start = nla_nest_start_noflag(skb, attrtype: TCA_TUNNEL_KEY_ENC_OPTS_GENEVE); |
579 | if (!start) |
580 | return -EMSGSIZE; |
581 | |
582 | while (len > 0) { |
583 | struct geneve_opt *opt = (struct geneve_opt *)src; |
584 | |
585 | if (nla_put_be16(skb, attrtype: TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS, |
586 | value: opt->opt_class) || |
587 | nla_put_u8(skb, attrtype: TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE, |
588 | value: opt->type) || |
589 | nla_put(skb, attrtype: TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA, |
590 | attrlen: opt->length * 4, data: opt + 1)) { |
591 | nla_nest_cancel(skb, start); |
592 | return -EMSGSIZE; |
593 | } |
594 | |
595 | len -= sizeof(struct geneve_opt) + opt->length * 4; |
596 | src += sizeof(struct geneve_opt) + opt->length * 4; |
597 | } |
598 | |
599 | nla_nest_end(skb, start); |
600 | return 0; |
601 | } |
602 | |
603 | static int tunnel_key_vxlan_opts_dump(struct sk_buff *skb, |
604 | const struct ip_tunnel_info *info) |
605 | { |
606 | struct vxlan_metadata *md = (struct vxlan_metadata *)(info + 1); |
607 | struct nlattr *start; |
608 | |
609 | start = nla_nest_start_noflag(skb, attrtype: TCA_TUNNEL_KEY_ENC_OPTS_VXLAN); |
610 | if (!start) |
611 | return -EMSGSIZE; |
612 | |
613 | if (nla_put_u32(skb, attrtype: TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP, value: md->gbp)) { |
614 | nla_nest_cancel(skb, start); |
615 | return -EMSGSIZE; |
616 | } |
617 | |
618 | nla_nest_end(skb, start); |
619 | return 0; |
620 | } |
621 | |
622 | static int tunnel_key_erspan_opts_dump(struct sk_buff *skb, |
623 | const struct ip_tunnel_info *info) |
624 | { |
625 | struct erspan_metadata *md = (struct erspan_metadata *)(info + 1); |
626 | struct nlattr *start; |
627 | |
628 | start = nla_nest_start_noflag(skb, attrtype: TCA_TUNNEL_KEY_ENC_OPTS_ERSPAN); |
629 | if (!start) |
630 | return -EMSGSIZE; |
631 | |
632 | if (nla_put_u8(skb, attrtype: TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_VER, value: md->version)) |
633 | goto err; |
634 | |
635 | if (md->version == 1 && |
636 | nla_put_be32(skb, attrtype: TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_INDEX, value: md->u.index)) |
637 | goto err; |
638 | |
639 | if (md->version == 2 && |
640 | (nla_put_u8(skb, attrtype: TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_DIR, |
641 | value: md->u.md2.dir) || |
642 | nla_put_u8(skb, attrtype: TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_HWID, |
643 | value: get_hwid(md2: &md->u.md2)))) |
644 | goto err; |
645 | |
646 | nla_nest_end(skb, start); |
647 | return 0; |
648 | err: |
649 | nla_nest_cancel(skb, start); |
650 | return -EMSGSIZE; |
651 | } |
652 | |
653 | static int tunnel_key_opts_dump(struct sk_buff *skb, |
654 | const struct ip_tunnel_info *info) |
655 | { |
656 | struct nlattr *start; |
657 | int err = -EINVAL; |
658 | |
659 | if (!info->options_len) |
660 | return 0; |
661 | |
662 | start = nla_nest_start_noflag(skb, attrtype: TCA_TUNNEL_KEY_ENC_OPTS); |
663 | if (!start) |
664 | return -EMSGSIZE; |
665 | |
666 | if (info->key.tun_flags & TUNNEL_GENEVE_OPT) { |
667 | err = tunnel_key_geneve_opts_dump(skb, info); |
668 | if (err) |
669 | goto err_out; |
670 | } else if (info->key.tun_flags & TUNNEL_VXLAN_OPT) { |
671 | err = tunnel_key_vxlan_opts_dump(skb, info); |
672 | if (err) |
673 | goto err_out; |
674 | } else if (info->key.tun_flags & TUNNEL_ERSPAN_OPT) { |
675 | err = tunnel_key_erspan_opts_dump(skb, info); |
676 | if (err) |
677 | goto err_out; |
678 | } else { |
679 | err_out: |
680 | nla_nest_cancel(skb, start); |
681 | return err; |
682 | } |
683 | |
684 | nla_nest_end(skb, start); |
685 | return 0; |
686 | } |
687 | |
688 | static int tunnel_key_dump_addresses(struct sk_buff *skb, |
689 | const struct ip_tunnel_info *info) |
690 | { |
691 | unsigned short family = ip_tunnel_info_af(tun_info: info); |
692 | |
693 | if (family == AF_INET) { |
694 | __be32 saddr = info->key.u.ipv4.src; |
695 | __be32 daddr = info->key.u.ipv4.dst; |
696 | |
697 | if (!nla_put_in_addr(skb, attrtype: TCA_TUNNEL_KEY_ENC_IPV4_SRC, addr: saddr) && |
698 | !nla_put_in_addr(skb, attrtype: TCA_TUNNEL_KEY_ENC_IPV4_DST, addr: daddr)) |
699 | return 0; |
700 | } |
701 | |
702 | if (family == AF_INET6) { |
703 | const struct in6_addr *saddr6 = &info->key.u.ipv6.src; |
704 | const struct in6_addr *daddr6 = &info->key.u.ipv6.dst; |
705 | |
706 | if (!nla_put_in6_addr(skb, |
707 | attrtype: TCA_TUNNEL_KEY_ENC_IPV6_SRC, addr: saddr6) && |
708 | !nla_put_in6_addr(skb, |
709 | attrtype: TCA_TUNNEL_KEY_ENC_IPV6_DST, addr: daddr6)) |
710 | return 0; |
711 | } |
712 | |
713 | return -EINVAL; |
714 | } |
715 | |
716 | static int tunnel_key_dump(struct sk_buff *skb, struct tc_action *a, |
717 | int bind, int ref) |
718 | { |
719 | unsigned char *b = skb_tail_pointer(skb); |
720 | struct tcf_tunnel_key *t = to_tunnel_key(a); |
721 | struct tcf_tunnel_key_params *params; |
722 | struct tc_tunnel_key opt = { |
723 | .index = t->tcf_index, |
724 | .refcnt = refcount_read(r: &t->tcf_refcnt) - ref, |
725 | .bindcnt = atomic_read(v: &t->tcf_bindcnt) - bind, |
726 | }; |
727 | struct tcf_t tm; |
728 | |
729 | spin_lock_bh(lock: &t->tcf_lock); |
730 | params = rcu_dereference_protected(t->params, |
731 | lockdep_is_held(&t->tcf_lock)); |
732 | opt.action = t->tcf_action; |
733 | opt.t_action = params->tcft_action; |
734 | |
735 | if (nla_put(skb, attrtype: TCA_TUNNEL_KEY_PARMS, attrlen: sizeof(opt), data: &opt)) |
736 | goto nla_put_failure; |
737 | |
738 | if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET) { |
739 | struct ip_tunnel_info *info = |
740 | ¶ms->tcft_enc_metadata->u.tun_info; |
741 | struct ip_tunnel_key *key = &info->key; |
742 | __be32 key_id = tunnel_id_to_key32(tun_id: key->tun_id); |
743 | |
744 | if (((key->tun_flags & TUNNEL_KEY) && |
745 | nla_put_be32(skb, attrtype: TCA_TUNNEL_KEY_ENC_KEY_ID, value: key_id)) || |
746 | tunnel_key_dump_addresses(skb, |
747 | info: ¶ms->tcft_enc_metadata->u.tun_info) || |
748 | (key->tp_dst && |
749 | nla_put_be16(skb, attrtype: TCA_TUNNEL_KEY_ENC_DST_PORT, |
750 | value: key->tp_dst)) || |
751 | nla_put_u8(skb, attrtype: TCA_TUNNEL_KEY_NO_CSUM, |
752 | value: !(key->tun_flags & TUNNEL_CSUM)) || |
753 | ((key->tun_flags & TUNNEL_DONT_FRAGMENT) && |
754 | nla_put_flag(skb, attrtype: TCA_TUNNEL_KEY_NO_FRAG)) || |
755 | tunnel_key_opts_dump(skb, info)) |
756 | goto nla_put_failure; |
757 | |
758 | if (key->tos && nla_put_u8(skb, attrtype: TCA_TUNNEL_KEY_ENC_TOS, value: key->tos)) |
759 | goto nla_put_failure; |
760 | |
761 | if (key->ttl && nla_put_u8(skb, attrtype: TCA_TUNNEL_KEY_ENC_TTL, value: key->ttl)) |
762 | goto nla_put_failure; |
763 | } |
764 | |
765 | tcf_tm_dump(dtm: &tm, stm: &t->tcf_tm); |
766 | if (nla_put_64bit(skb, attrtype: TCA_TUNNEL_KEY_TM, attrlen: sizeof(tm), |
767 | data: &tm, padattr: TCA_TUNNEL_KEY_PAD)) |
768 | goto nla_put_failure; |
769 | spin_unlock_bh(lock: &t->tcf_lock); |
770 | |
771 | return skb->len; |
772 | |
773 | nla_put_failure: |
774 | spin_unlock_bh(lock: &t->tcf_lock); |
775 | nlmsg_trim(skb, mark: b); |
776 | return -1; |
777 | } |
778 | |
779 | static void tcf_tunnel_encap_put_tunnel(void *priv) |
780 | { |
781 | struct ip_tunnel_info *tunnel = priv; |
782 | |
783 | kfree(objp: tunnel); |
784 | } |
785 | |
786 | static int tcf_tunnel_encap_get_tunnel(struct flow_action_entry *entry, |
787 | const struct tc_action *act) |
788 | { |
789 | entry->tunnel = tcf_tunnel_info_copy(a: act); |
790 | if (!entry->tunnel) |
791 | return -ENOMEM; |
792 | entry->destructor = tcf_tunnel_encap_put_tunnel; |
793 | entry->destructor_priv = entry->tunnel; |
794 | return 0; |
795 | } |
796 | |
797 | static int tcf_tunnel_key_offload_act_setup(struct tc_action *act, |
798 | void *entry_data, |
799 | u32 *index_inc, |
800 | bool bind, |
801 | struct netlink_ext_ack *extack) |
802 | { |
803 | int err; |
804 | |
805 | if (bind) { |
806 | struct flow_action_entry *entry = entry_data; |
807 | |
808 | if (is_tcf_tunnel_set(a: act)) { |
809 | entry->id = FLOW_ACTION_TUNNEL_ENCAP; |
810 | err = tcf_tunnel_encap_get_tunnel(entry, act); |
811 | if (err) |
812 | return err; |
813 | } else if (is_tcf_tunnel_release(a: act)) { |
814 | entry->id = FLOW_ACTION_TUNNEL_DECAP; |
815 | } else { |
816 | NL_SET_ERR_MSG_MOD(extack, "Unsupported tunnel key mode offload" ); |
817 | return -EOPNOTSUPP; |
818 | } |
819 | *index_inc = 1; |
820 | } else { |
821 | struct flow_offload_action *fl_action = entry_data; |
822 | |
823 | if (is_tcf_tunnel_set(a: act)) |
824 | fl_action->id = FLOW_ACTION_TUNNEL_ENCAP; |
825 | else if (is_tcf_tunnel_release(a: act)) |
826 | fl_action->id = FLOW_ACTION_TUNNEL_DECAP; |
827 | else |
828 | return -EOPNOTSUPP; |
829 | } |
830 | |
831 | return 0; |
832 | } |
833 | |
834 | static struct tc_action_ops act_tunnel_key_ops = { |
835 | .kind = "tunnel_key" , |
836 | .id = TCA_ID_TUNNEL_KEY, |
837 | .owner = THIS_MODULE, |
838 | .act = tunnel_key_act, |
839 | .dump = tunnel_key_dump, |
840 | .init = tunnel_key_init, |
841 | .cleanup = tunnel_key_release, |
842 | .offload_act_setup = tcf_tunnel_key_offload_act_setup, |
843 | .size = sizeof(struct tcf_tunnel_key), |
844 | }; |
845 | |
846 | static __net_init int tunnel_key_init_net(struct net *net) |
847 | { |
848 | struct tc_action_net *tn = net_generic(net, id: act_tunnel_key_ops.net_id); |
849 | |
850 | return tc_action_net_init(net, tn, ops: &act_tunnel_key_ops); |
851 | } |
852 | |
853 | static void __net_exit tunnel_key_exit_net(struct list_head *net_list) |
854 | { |
855 | tc_action_net_exit(net_list, id: act_tunnel_key_ops.net_id); |
856 | } |
857 | |
858 | static struct pernet_operations tunnel_key_net_ops = { |
859 | .init = tunnel_key_init_net, |
860 | .exit_batch = tunnel_key_exit_net, |
861 | .id = &act_tunnel_key_ops.net_id, |
862 | .size = sizeof(struct tc_action_net), |
863 | }; |
864 | |
865 | static int __init tunnel_key_init_module(void) |
866 | { |
867 | return tcf_register_action(a: &act_tunnel_key_ops, ops: &tunnel_key_net_ops); |
868 | } |
869 | |
870 | static void __exit tunnel_key_cleanup_module(void) |
871 | { |
872 | tcf_unregister_action(a: &act_tunnel_key_ops, ops: &tunnel_key_net_ops); |
873 | } |
874 | |
875 | module_init(tunnel_key_init_module); |
876 | module_exit(tunnel_key_cleanup_module); |
877 | |
878 | MODULE_AUTHOR("Amir Vadai <amir@vadai.me>" ); |
879 | MODULE_DESCRIPTION("ip tunnel manipulation actions" ); |
880 | MODULE_LICENSE("GPL v2" ); |
881 | |